---
id: "CVE-2026-110707"
kind: "vulnerability"
aliases: ["CVE-2026-110707"]
title: "RSS Aggregator by Feedzy WordPress plugin: stored XSS via imported feed descriptions"
severity: "medium"
cvss: 4.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["feedzy", "package", "wordpress", "wordpress-plugins"]
not_affected_if: ["no-feed-imports", "plugin-newer-than-5.2.12", "plugin-not-installed"]
published_at: "2026-10-29T10:17:02+00:00"
first_seen_at: "2026-10-29T10:24:25+00:00"
updated_at: "2026-10-29T10:25:34+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110707", "first_seen_at": "2026-10-29T10:24:25+00:00"}]
---

# RSS Aggregator by Feedzy WordPress plugin: stored XSS via imported feed descriptions

The RSS Aggregator by Feedzy WordPress plugin fails to sanitize the media:group/media:description element of imported feeds, so script can be stored in posts. When an administrator runs an import from an attacker-controlled feed, the injected script executes in the browser of anyone who opens the affected page.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in the WordPress admin Plugins screen or with `wp plugin get feedzy-rss-feeds --field=version` (plugin slug assumed; unknown if the sources give it)
- Look for Feed-to-Post import jobs that pull from external feed URLs you do not control

## Fix

- Move the RSS Aggregator by Feedzy plugin to a version later than `5.2.12`; the sources do not name the fixed version

## Timeline

- 2026-10-29T10:24:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110707

## From the sources

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media:group/media:description (XML element in the imported feed)' parameter in all versions up to, and including, 5.2.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an administrator to configure a Feed-to-Post import pointing at an attacker-controlled feed URL and trigger the import via the Run Now action or setup wizard, which is the plugin's standard configuration flow.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_